The local skill stays free. This page is about something that does not exist yet.
A register of interest in a possible hosted SecHelix Cloud. The local skill stays open-source and unpaywalled under Apache-2.0. Nothing on this page is available, nothing is for sale, and there is no billing.
The sentence that matters most on this page
The open core is explicitly enumerated in that document as staying public:
- The canonical SKILL.md methodology.
- The core coverage catalog.
- The evidence and verification model.
- The standard agent adapters.
- The validation and release-gate scripts.
- The public evaluation fixtures and benchmark methodology.
- The static documentation and this website.
What does not exist
- No payment is taken, no card is stored, no invoice is issued, and no trial starts.
- There is no waitlist position, no queue number, no counter, and no countdown. Writing in does not reserve anything, because there is nothing to reserve.
- No claim is made about how many people have written in. That number would be trivial to invent and impossible for you to check, so it is not published.
- If a hosted product is ever announced, it will be announced in the repository changelog and release notes first — not by an email telling you your place in a queue.
What a hosted SecHelix would add — if it is built
The design sketch below is a plan document, not a roadmap commitment and not a feature list you can order from. Every row is unbuilt. No dates are published, because a single maintainer sequences this work and inventing a schedule would be its own dishonest claim.
| Capability | Status | What it would mean |
|---|---|---|
| Hosted audit history | NOT BUILT | Reports retained across runs so a regression is visible as a change rather than re-derived each time. |
| Scheduled audits | NOT BUILT | Runs triggered on a schedule instead of only when a person remembers to ask for one. |
| Pull-request bot | NOT BUILT | The PR-review mode running automatically on a diff and posting the release decision back. |
| Private evidence storage | NOT BUILT | Evidence and artifacts held somewhere with retention and redaction rules, instead of in a local working directory. |
| Managed policy packs | NOT BUILT | Organization severity overrides, accepted-risk approvals, and gate policy applied centrally. |
| Organization-wide authorization graph | NOT BUILT | The role-by-object-by-action matrix maintained across services rather than rebuilt per repository. |
| RBAC | NOT BUILT | Who may run an audit, approve a known risk, or read stored evidence. |
| SSO | NOT BUILT | Identity provided by your directory rather than by a separate set of credentials. |
The longer sketch, including the parts deliberately left out, is in docs/business/commercial.md and ROADMAP.md.
Register interest
Two ways to say you want this, both of which go to a person:
- Open a pre-filled email draft — it opens in your own mail client, pre-filled with the two optional prompts a form would have asked for: where to reply, and what you would use it for. Edit or delete anything before you send it. The address you send from is the address that gets the reply, so there is no separate field to fill in. If you would rather write it yourself, the address is [email protected].
- Post in GitHub Discussions — better if you want other people to see the request and add to it. It is a public thread, so post nothing you would not want indexed.
- What happens to your message
- It arrives in one person’s mailbox and is answered by that person, or it is not answered. It is not added to a mailing list, fed into a CRM, or used for anything other than replying to you.
- What you will not get
- A drip sequence, an onboarding series, a “your spot is reserved” confirmation, or a follow-up asking you to invite colleagues. None of that machinery exists.
- Removing yourself
- Reply and say so, and the thread is deleted. There is no subscription to unsubscribe from, because you were never subscribed to anything.
- What not to send
- No credentials, private source, customer data, or internal hostnames — in the email or, especially, in the public discussion.
What you can actually use today
All of it, locally, for free, right now. The install command is the same one on every other page of this site:
npx skills@latest add omarmohelal/SecHelix --skill sechelixIt installs the skill into your project so a coding agent can load it. The skill is files: it needs no account, it has no service behind it to sign in to, and its scripts require only the Python standard library. Your coding agent is still your coding agent, with whatever network access you have given it. And the full-workflow benchmark is still NOT_MEASURED — one blind label-only run exists, and it does not measure the verifier, remediation or the release gate — which is the other thing this project would rather you knew before you decide how much to trust it.